Review code at for size, TODO density, missing docstrings, naming, complexity. Returns {status, findings[], summary}. Default: heuristic. Pass use_llm=true to call configured model.

Lint Python/JS/TS files at . Returns {status, findings[], summary}. Engines: ruff (Python), eslint (JS/TS). status='skipped' means engine not on PATH.

Format Python/JS/TS files at . Returns {status, findings[], summary}. Engines: ruff format (Python), prettier (JS/TS). Always check-only in v0.1.

Run tests for project at . Returns {status, findings[], summary}. Engines: pytest (Python), vitest/npm (JS/TS). status='skipped' means engine not on PATH.

Scan deps at for known vulnerabilities. Returns {status, findings[], summary}. Engines: pip-audit (Python), npm audit (JS/TS). status='skipped' means engine not on PATH.

Type-check Python and JS/TS at . Uses mypy or tsc; missing engines return status='skipped'.

Find unused Python and JS/TS code at . Uses vulture or knip; missing engines return status='skipped'.

Measure Python and JS/TS complexity at . Uses radon or jscpd; missing engines return status='skipped'.

Detect Python AI slop and deterministic JS/TS noise at ; missing sloppylint returns status='skipped' when no JS/TS fallback applies.

Check Markdown at without rewriting files; missing markdownlint-cli returns status='skipped'.

Check GitHub Actions workflows without rewriting; missing actionlint returns status='skipped'.

Check YAML without rewriting; missing spectral returns status='skipped'.

Check SQL without rewriting; missing sqlfluff returns status='skipped'.

Check templates without rewriting; missing djlint returns status='skipped'.

Check container files without rewriting; missing hadolint returns status='skipped'.

Check Terraform without rewriting; missing local engines return status='skipped'.

Scan for secrets without exposing values; missing gitleaks returns status='skipped'.

Generate an SBOM only to a safe explicit output path; missing cdxgen returns status='skipped'.

Import a local coverage report or run coverage analysis under --allow-slow.

Import a local CodeQL SARIF report or run CodeQL analysis under --allow-build.

Run configured E2E tests only with --allow-browser.

Import a local snapshot comparison or run snapshot tests under --allow-slow.

Check visual baselines; updates require --accept.

Import a local property-test report or run property tests under --allow-slow.

Import a local mutation report or run mutation testing under --allow-slow.

Import a local JUnit report or run duplicate test analysis under --allow-slow.

Import a local Pact report or run local contract verifications under --allow-slow.

Import a local fuzz report or execute local fuzz tests under --allow-slow.

Import a local load report or execute load traffic under --allow-network.

Validate supplied Conventional Commit messages without modifying Git history.

Save, list, or restore a local Rush session checkpoint. Returns {status, findings[], summary}; saving requires explicit cache-write permission.

Inspect local CI workflow configuration without accessing credentials or remote status.

Create a dry-run release plan; publishing requires explicit confirmation.

Semantic drift detection comparing rendered DOM/accessibility against baseline. Requires both --allow-browser and --allow-slow.

Evaluate LLM prompts, agent workflows, and safety guardrails. Requires explicit permissions for live inference runs.

Verify Test-Driven Development (TDD) compliance at . Returns {status, findings[], summary}.

Safely auto-remediate formatting and linter issues at . Returns {status, findings[], summary}. Enforces strict path confinement.

Diagnose environment health, toolchain integrity, and binary resolution at . Returns {status, findings[], summary}.

Clean scratch directories and build caches before release

Audit codebase environment variable usage against .env.example

Run 7-vector pre-flight release readiness cockpit

Generate token-efficient AST skeleton outline of a code file

Retrieve uncompressed content from CCR chunk store by hash

Audit code imports against installed packages and stdlib

Check git revert history for past mistakes and anti-patterns

Pack graph-pruned context outline under a strict token budget

Get real-time token economy savings and cost metrics

Calculate downstream transitive blast radius for a changed file

Validate codebase against clean architecture layer boundaries

Diagnose flaky test race conditions and suggest fixes

Detect breaking public API changes against base Git ref

Audit ORM models against migrations to detect schema drift

Decompose high-complexity functions into modular helpers

Synthesize runtime type guards for unvalidated parameters

Scan codebase and specs to output requirement traceability matrix

Acquire non-blocking multi-agent file lock

Release multi-agent file lock

Execute 3-way AST merge conflict resolution

Generate in-toto SLSA Level 3 provenance statement

Audit open-source dependencies for license risks

Synthesize least-privilege cloud IAM policy

Scan for unreferenced assets and dead media

Synthesize structured semantic pull request card